NAME

nsswitch.conf - 系統(tǒng)數(shù)據(jù)庫(kù)及名字服務(wù)開關(guān)配置文件

DESCRIPTION

C 程序庫(kù)里很多函數(shù)都需要配置以便能在本地環(huán)境正常工作, 習(xí)慣上是使用文件(例如`/etc/passwd') 來完成這一任務(wù). 但別的名字服務(wù), 如網(wǎng)絡(luò)信息服務(wù)NIS, 還有域名服務(wù)DNS等, 逐漸通用起來, 并且被加入了C 程序庫(kù)里, 而它們使用的是固定的搜索順序.

在有NYS 支持的Linux libc5以及GNU C Library 2.x (libc.so.6)里, 依靠一個(gè)更清晰完整的方案來解決該問題. 該方案模仿了Sun Microsystems公司在Solaris 2 的C 程序庫(kù)里的方法, 也沿襲了它們的命名, 稱為 "名字服務(wù)開關(guān)(NSS)". 所用 "數(shù)據(jù)庫(kù)" 及其查找順序在文件 /etc/nsswitch.conf 里指明.

NSS 中可用數(shù)據(jù)庫(kù)如下:

aliases 郵件別名, sendmail(8) 使用該文件.

ethers 以太網(wǎng)號(hào).

group 用戶組, getgrent(3) 函數(shù)使用該文件.

hosts 主機(jī)名和主機(jī)號(hào), gethostbyname(3) 以及類似的函數(shù)使用了該文件.

netgroup 網(wǎng)絡(luò)內(nèi)主機(jī)及其用戶的列表, 訪問規(guī)則使用該文件.

network 網(wǎng)絡(luò)名及網(wǎng)絡(luò)號(hào), getnetent(3) 函數(shù)使用該文件.

passwd 用戶口令, getpwent(3) 函數(shù)使用該文件.

protocols 網(wǎng)絡(luò)協(xié)議, getprotoent(3) 函數(shù)使用該文件.

publickey NIS+及NFS 所使用的secure_rpc的公開密匙.

rpc

遠(yuǎn)程過程調(diào)用名及調(diào)用號(hào), getrpcbyname(3) 及類似函數(shù)使用該文件.

services 網(wǎng)絡(luò)服務(wù), getservent(3) 函數(shù)使用該文件.

shadow shadow用戶口令, getspnam(3) 函數(shù)使用該文件.

下面是

/etc/nsswitch.conf 文件的一個(gè)例子 (如果在系統(tǒng)中沒有 /etc/nsswitch.conf 文件的話, 這就是缺省的設(shè)置):

passwd:

compat

group:

compat

shadow:

compat

hosts:

dns [!UNAVAIL=return] files

networks:

nis [NOTFOUND=return] files

ethers:

nis [NOTFOUND=return] files

protocols:

nis [NOTFOUND=return] files

rpc:

nis [NOTFOUND=return] files

services:

nis [NOTFOUND=return] files

第一欄就是上面的表里所說的數(shù)據(jù)庫(kù), 每行的其余部分指明如何查找. 對(duì)每個(gè)數(shù)據(jù)庫(kù)都可以分別指明其查找方法.

每個(gè)數(shù)據(jù)庫(kù)的配置規(guī)范包含兩個(gè)不同的項(xiàng):

* 服務(wù)規(guī)范, 如`files', `db', 或者`nis'.

* 對(duì)查找結(jié)果的反應(yīng), 如`[NOTFOUND=return]'.

在有NYS支持的libc5里允許服務(wù)規(guī)范`files', `nis'及`nisplus',此外，還可以對(duì)hosts 指明`dns' 為額外服務(wù), 對(duì)passwd及group 指明`compat', 但不能對(duì)shadow指明`compat'.

在GNU C Library里, 每個(gè)可用的SERVICE都必須有文件 /lib/libnss_SERVICE.so.1 與之對(duì)應(yīng). 在標(biāo)準(zhǔn)安裝時(shí), 可以使用`files',`db', `nis'以及`nisplus'. 此外, 還可以對(duì)hosts 指明`dns' 為額外服務(wù), 對(duì)passwd, group, shadow 指明`compat', 而在有NYS 支持的libc5中, 不支持最后一項(xiàng)服務(wù).

說明中的第二項(xiàng)使用戶可以更好地控制查找過程. Action項(xiàng)處于兩個(gè)服務(wù)名之間, 被括弧括著, 常規(guī)格式如下:

`[' ( `!'? STATUS `=' ACTION )+ `]'

這里

STATUS => success | notfound | unavail | tryagain

ACTION => return | continue

對(duì)關(guān)鍵字的大小寫并不敏感. STATUS的值是調(diào)用指定服務(wù)查找函數(shù)的結(jié)果, 意義如下:

success

沒有錯(cuò)誤發(fā)生, 得到想要的結(jié)果. 缺省action是`return'.

notfound 查找順利, 但是沒有得到所要的結(jié)果. 缺省action是`continue'.

unavail 服務(wù)永久不可用. 這可能意味著必要的文件不可用, 或者,DNS 服務(wù)不可用或不允許查詢.缺省action是`continue'.

tryagain 服務(wù)臨時(shí)不可用. 可能是文件被鎖住了或者服務(wù)器當(dāng)前不 接受過多的連接. 缺省action是`continue'.

使用+/-語(yǔ)法的交互(compat 模式)無(wú)NYS支持的linux libc5沒有名字服務(wù)開關(guān), 但允許用戶做一些簡(jiǎn)單的策略控制. 在 /etc/passwd 里可以使用+user或+@netgroup條目(即包括NIS passwd映射所指定用戶), 以及-user或-@netgroup條目(即不包括被指定用戶), 還有 + 條目(即包括每個(gè)用戶, 除了NIS passwd映射所排除的). 大多數(shù)人只放一個(gè) + 在 /etc/passwd 末尾, 以此包括NIS 的所有東西. 對(duì)該情況, 開關(guān)提供更快捷的替代方式(`passwd: files nis'), 這使得無(wú)需再往 /etc/passwd, /etc/group 及 /etc/shadow 里添加單個(gè) + 條目. 如果這還不夠, NSS 的`compat' 服務(wù)提供了完全的+/-語(yǔ)法. 我們可以對(duì)偽數(shù)據(jù)庫(kù) passwd_compat, group_compat 及 shadow_compat 指明`nisplus'服務(wù)來覆蓋缺省服務(wù)`nis', 但請(qǐng)注意只在GNU C Library里可以使用偽數(shù)據(jù)庫(kù).

文件 FILES

名為SERVICE的服務(wù)是通過位于/lib的共享對(duì)象libnss_SERVICE.so.1實(shí)現(xiàn)的.

/etc/nsswitch.conf 配置文件

/lib/libnss_compat.so.1 為GNU C Library 2.x實(shí)現(xiàn)`compat'

/lib/libnss_db.so.1

為GNU C Library 2.x實(shí)現(xiàn)`db'

/lib/libnss_dns.so.1 為GNU C Library 2.x實(shí)現(xiàn)`dns'

/lib/libnss_files.so.1

為GNU C Library 2.x實(shí)現(xiàn)`files'

/lib/libnss_hesoid.so.1 為GNU C Library 2.x實(shí)現(xiàn)`hesoid'

/lib/libnss_nis.so.1 為GNU C Library 2.x實(shí)現(xiàn)`nis'

/lib/libnss_nisplus.so.1 為GNU C Library 2.x實(shí)現(xiàn)`nisplus'

注意 NOTES

每個(gè)用到了nsswitch.conf 文件的進(jìn)程只完整地讀一次文件, 如果該文件后面被改變了, 進(jìn)程將仍然使用原來的配置.

在Solaris 下, 不能靜態(tài)連接使用了NSS Service 的程序, 但是在Linux 下, 則毫無(wú)問題.

#p#

NAME

nsswitch.conf - System Databases and Name Service Switch configuration file  

DESCRIPTION

Various functions in the C Library need to be configured to work correctly in the local environment. Traditionally, this was done by using files (e.g., `/etc/passwd'), but other nameservices (like the Network Information Service (NIS) and the Domain Name Service (DNS)) became popular, and were hacked into the C library, usually with a fixed search order.

The Linux libc5 with NYS support and the GNU C Library 2.x (libc.so.6) contain a cleaner solution of this problem. It is designed after a method used by Sun Microsystems in the C library of Solaris 2. We follow their name and call this scheme "Name Service Switch" (NSS). The sources for the "databases" and their lookup order are specified in the /etc/nsswitch.conf file.

The following databases are available in the NSS:

aliases

Mail aliases, used by sendmail(8). Presently ignored.

ethers

Ethernet numbers.

group

Groups of users, used by getgrent(3) functions.

hosts

Host names and numbers, used by gethostbyname(3) and similar functions.

netgroup

Network wide list of hosts and users, used for access rules. C libraries before glibc 2.1 only support netgroups over NIS.

network

Network names and numbers, used by getnetent(3) functions.

passwd

User passwords, used by getpwent(3) functions.

protocols

Network protocols, used by getprotoent(3) functions.

publickey

Public and secret keys for Secure_RPC used by NFS and NIS+.

rpc

Remote procedure call names and numbers, used by getrpcbyname(3) and similar functions.

services

Network services, used by getservent(3) functions.

shadow

Shadow user passwords, used by getspnam(3).

An example /etc/nsswitch.conf (namely, the default used when /etc/nsswitch.conf is missing):

passwd:

compat

group:

compat

shadow:

compat

hosts:

dns [!UNAVAIL=return] files

networks:

nis [NOTFOUND=return] files

ethers:

nis [NOTFOUND=return] files

protocols:

nis [NOTFOUND=return] files

rpc:

nis [NOTFOUND=return] files

services:

nis [NOTFOUND=return] files

The first column is the database. The rest of the line specifies how the lookup process works. You can specify the way it works for each database individually.

The configuration specification for each database can contain two different items:

* The service specification like `files', `db', or `nis'.

* The reaction on lookup result like `[NOTFOUND=return]'.

For libc5 with NYS, the allowed service specifications are `files', `nis', and `nisplus'. For hosts, you could specify `dns' as extra service, for passwd and group `compat', but not for shadow.

For glibc, you must have a file called /lib/libnss_SERVICE.so.X for every SERVICE you are using. On a standard installation, you could use `files', `db', `nis', and `nisplus'. For hosts, you could specify `dns' as extra service, for passwd, group, and shadow `compat'. These services will not be used by libc5 with NYS. The version number X is 1 for glibc 2.0 and 2 for glibc 2.1.

The second item in the specification gives the user much finer control on the lookup process. Action items are placed between two service names and are written within brackets. The general form is

`[' ( `!'? STATUS `=' ACTION )+ `]'

where

STATUS => success | notfound | unavail | tryagain

ACTION => return | continue

The case of the keywords is insignificant. The STATUS values are the results of a call to a lookup function of a specific service. They mean:

success

No error occurred and the wanted entry is returned. The default action for this is `return'.

notfound

The lookup process works ok but the needed value was not found. The default action is `continue'.

unavail

The service is permanently unavailable. This can either mean the needed file is not available, or, for DNS, the server is not available or does not allow queries. The default action is `continue'.

tryagain